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DATASETS 


1) HISTORICAL 


e Actively traded cases 
involving identified 
victims: July 1, 2002 
— June 30, 2014 


+ 518 cases involving 
933 identified victims 


2) MODERN 


+ All cases involving 
identified victims: 
July 1, 2011 — June 
30, 2014 


+ 1,965 cases: one 
offender and one victim 


e 633 cases: multiple 
offenders and/or victims 


The National Center for Missing & Exploited Children (NCMEC) has 
access to unique data about child exploitation images, particularly 
those involving identified victims and offenders and reported by 
multiple law enforcement agencies. 


Through the cooperation of NCMEC, and with 
the financial support of Thorn, we were able to 
extract data from NCMEC databases to address 
multiple research questions. 


The primary objective in this project was to 
develop knowledge to assist law enforcement 
in identifying victims of child sexual abuse 
material and intervening to prevent child sexual 
exploitation and abuse. 


In this study, the first of its kind, we were able 
to analyze data from two different datasets: 
(1) a historical dataset that encompassed all 


actively traded cases involving identified victims 
from July 1, 2002, to June 30, 2014 (518 cases 
involving 933 victims); (2) a modern dataset 
encompassing all cases involving identified 
victims from July 1, 2011, to June 30, 2014 (1,965 
cases involving one offender and one victim, and 
633 cases involving multiple offenders and/or 
victims; only a small minority of these cases were 
actively traded). The historical set allowed us to 
examine trends over time, whereas the modern 
dataset had more information due to a more 
comprehensive law enforcement submission 
form implemented in 2011. 
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Report Highlights 


1 The most notable historical finding was a trend toward more egregious sexual content over 
time, with more cases involving explicit sexual conduct in later years. In contrast, there were 
no obvious trends in terms of child victim age or gender. 


2 In cases involving a single victim and single offender, actively traded cases were associated 

with having prepubescent victims. Actively traded cases were also associated with more 

egregious content in terms of sexual activity, and more likely to involve familial offenders, 
particularly nuclear family members. 


K While most cases involved male offenders who were unrelated to the child, cases involving 
female offenders, younger children, or more egregious content were more likely to involve 
familial offenders. 


These results have implications for law enforcement investigations regarding adult-created child 
pornography cases through a better understanding of the relationships between child, offender, 
and offense characteristics. 
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The primary objective in this project was to develop knowledge to assist 
law enforcement in identifying victims of child sexual abuse material 
and intervening to prevent child sexual exploitation and abuse. 


WE WERE ABLE TO EXAMINE THE FOLLOWING RESEARCH QUESTIONS: 


1. From data about all identified, actively traded 
cases (involving 5 or more reports to NCMEC) 
from 2002 to 2013, are there longer-term 
trends in the nature of the content analyzed 
by NCMEC, in terms of the age, gender, or 
sexual activity involving depicted children? 


From data involving identified child victims 
between July 1, 2011, and June 30, 2014, whether 
actively traded or not, we examined the following 
research questions, first by focusing on data 
from cases involving a single offender and a 


single victim, and then including cases involving 
multiple offenders and/or victims: 


2. Was actively traded status (5 or more 
reports to NCMEC) associated with victim 
age or gender, offender age or gender, 
sexual activity level, or relationship between 
offender and victim? 

3. Given some offenders were family members 
of victims, was familial relationship 
associated with victim age or gender, 
offender gender, or sexual activity level? 
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Online child sexual exploitation is an international 
problem, because these production and 
distribution technologies transcend national 
borders. There is also wide variation in child 
pornography laws around the globe, according 
to a recent review by the International Centre for 
Missing & Exploited Children (2016). There are 
growing concerns about the sexual exploitation 
and abuse of children as new technologies 
create more opportunities for perpetrators (Seto, 
2013). Although the total number of children 
who have been sexually exploited or abused and 
photographed is unknown, the number of arrests 
for adult-produced child pornography in the U.S. 
practically doubled between 2000 and 2009, 
resulting in more than 1/3 of arrested producers 
of child pornography in 2009 being adults who 
created the images of the children themselves 
(37%) (Wolak, Finkelhor, & Mitchell, 2012). 


There is limited scientific understanding of 

the characteristics of these children who are 
victimized in child pornography images/videos 
and their relationship with those who have 
sexually abused them. It is not known how these 
factors may change over time or vary across 
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sociocultural contexts such as ethnicity or 
poverty. Existing research has provided some 
insight about cohorts of identified children, or of 
images seized from the computers of offenders, 
but there are many unaddressed questions. More 
is known about perpetrators than victims at this 
time (e.g., Long et al., 2016; Quayle & Jones, 2011; 
Seto, 2013; Seto & Eke, 2015, in press; Seto, Wood, 
Babchishin & Flynn, 2012; Taylor & Quayle, 2003). 


Knowledge gained from this research can lead 

to a better understanding of online victimization 
and offending, thereby supporting more effective 
and efficient prevention and law enforcement 
initiatives to protect children. The results of 

this research could have international impact 
given the professional networks the researchers 
have in their respective countries and the 
relationships NCMEC has with the international 
law enforcement community. For example, there 
are many questions about longer-term trends 

in the production of child exploitation content, 
and whether more actively traded content differs 
from non-traded content in victim or offender 
characteristics. 


Given younger children appear to be at greater 
risk of sexual abuse by family members than from 
non-relatives, reflecting access and opportunity 
(Snyder, 2000), is it also the case that exploitation 
content depicting younger children are more 
likely to involve familial offenders? Finding this 
association could help guide law enforcement 
investigations. As another example, evidence 
that child characteristics, such as gender and 
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Principal Investigator: Michael Seto, PhD, 
forensic research director at the Royal Ottawa 
Health Care Group and an Associate Professor 
in Psychiatry at the University of Toronto, with 
cross-appointments to Ryerson University, 
Carleton University, and the University of 
Ottawa (Canada). 


Co-Investigators: R. Gregg Dwyer, MD, EdD, 
Associate Professor and Director of Community 
and Public Safety Psychiatry, Director of the 
Sexual Behaviors Clinic and Lab, Department 
of Psychiatry and Behavioral Sciences, Medical 
University of South Carolina (USA). 


Ethel Quayle, PhD, Reader, School of Health 
and Social Science, University of Edinburgh 
(Scotland). 


Research Coordinator: Cierra Buckman, MHS, 
Senior Research Program Coordinator at the 
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age, are related to distribution or other offending 
characteristics would support the development 
of computer algorithms to categorize large 
collections of child exploitation images. Seto and 
Eke's (2015) predictive research has shown the 
ratio of boy to girl content is associated with the 
likelihood of future sexual offending, so finding 
associations between child gender and other 
study variables would extend this research. 


Moore Center for the Prevention of Child Sexual 
Abuse, Bloomberg School of Public Health, 
Johns Hopkins University (USA). 


The work was completed in collaboration with the 
National Center for Missing & Exploited Children 
(NCMEC) staff. 


This project was funded by Thorn, a nonprofit 
organization dedicated to driving technology 
innovation to combat child sexual exploitation. 
Thorn partners with nonprofits and academic 
institutions to gather new insights into the role 
technology plays in child sex trafficking, the 
creation and proliferation of child pornography, 
and the normalization of child sexual exploitation. 
Thorn then goes beyond insight to action to 
develop the tools, systems, and approaches to 
help address these issues (learn more at 


www.wearethorn.org). 
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Database 


NCMEC is a private, nonprofit organization 
established in 1984 (learn more at www. 


missingkids.org). It was created to help find 


missing children, reduce child sexual exploitation, 


and prevent child victimization. NCMEC serves as 
the national clearinghouse for families, victims, 
private industry, law enforcement, and other 
professionals on issues related to missing and 
sexually exploited children. NCMEC’s Exploited 
Children Division operates the CyberTipline® and 
Child Victim Identification Program® (CVIP®). 
CVIP primarily helps to verify whether or not 
child exploitation images appear to depict 
children who have been previously identified 

by law enforcement agencies as actual (rather 
than virtual or computer-generated) children 
and helps law enforcement identify new child 
pornography victims. CVIP maintains a database 
of information related to child sexual exploitation 
images, containing both identified and 
unidentified children. 


When NCMEC introduced CVIP in 2002, the 
record-keeping for identified children was 
effective, but basic. As CVIP’s reputation and 
recognition grew, so did their program. Law 
enforcement began seeking their assistance on 
hundreds and thousands of cases. At this point, 
CVIP moved their records to a case management 
system and formalized submissions with a law 
enforcement submission guideline form. The 
form's first edition was still rather simple and 
asked for standard information, such as data 
about the victims involved in the case, the 
jurisdiction, a point of contact and such. [Please 
note, NCMEC does not request nor record the 
names of victims in any of its systems.] However, 
the process quickly became more sophisticated 
and they added new variables and categories 
to each iteration of the guideline form. By 2014, 
the submission guideline contained multiple 
pages and additional case details were requested 
and captured in the system. Data from each 
submission was now entered into its respective 
field and images were coded by analysts based 
on their content. 
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The CVIP database provides a unique opportunity 
for research related to online sexual exploitation 
and abuse of children because it is a central 
repository for data that crosses geographical, 
jurisdictional, and operational lines. CVIP 

works in conjunction with several national 

and international organizations to move cases 
along as quickly as possible. They also work 
closely with law enforcement agencies, internet 
service providers, victim attorneys, and child 
welfare organizations throughout the U.S. They 
have processed millions of cases and helped 

to identify thousands of child sexual abuse 
victims. As a result, their database has access 
to very large, broad, and unedited datasets, 
including information about child pornography 
collections, victim characteristics, and offender 
characteristics. 


Vocabulary 


Given the evolution of the NCMEC database, the 
information in the CVIP records was not originally 
intended or designed for research purposes. As 
such, historically they used in-house language 
for variables. In an effort to fully capture the 
nuances of their database, we have adopted their 
language for certain variables and categories 

as well. Below are a few key definitions to help 
readers understand the data as we describe our 
collection process and analytical methods. 
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Case/Series — A series is a group of images 
focusing on a specific child(ren) and, when traded 
or collected, is most often done so as a Set. “Series” 
and “case” are synonymous within this report. 


Actively Traded — A term designated by NCMEC 
referring to a series that has been seen in 5 or 
more CyberTipline Reports and/or CVIP case 
reviews. 


Victim — Any child visible in the material who 
is younger than 18. Please note, only identified 
victim data have been included in this analysis. 


Offender — The person who is proven or believed 
to have produced and/or enticed or coerced the 
images to be produced by a child. 


Age Category — This is coded based on physical 
development of the victim (limited to three 
categories: infant/toddler, prepubescent, and 
pubescent) based on the youngest appearance of 
a child in a series of images or videos. 


The database also includes other high-interest 
variables, some which are coded on a series-level 
and some which are coded on an individual- 
level. Those coded on a series-level reflect data 
for the series overall regardless of number of 
victims and/or offenders. Those coded on an 
individual-level reflect data for that specific child 
victim or offender. Below is a list of some of these 
variables, and how they were coded. 


VARIABLE CODING LEVEL 
Gender Individual 
Ethnicity Individual 
Relationship of Abuse a 

to Child Individual 
Jurisdiction Series 
Date NCMEC Received Series 
the Submission 

Approximate Time : 
Frame of Production aerie 
Number of Images Series 
Sexual Activity Checklist Series 


Additional fields on both individual- and series- 
levels were also reviewed during the study. 
However, the definitions of these variables 

are much more straightforward and align with 
existing definitions in the research literature. 


Inclusion and Exclusion Criteria 


Data for our investigation was limited to cases 
with an identified victim and one or more adult 
offenders. Since access to the images and 
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DESCRIPTION 


Gender of child victim/offender 


Ethnicity of child victim/offender 


Categorization of the relationship between each child 
victim and each offender 


Specific U.S. state or “International” designation of 
where the files were produced 


Date NCMEC received the case submission by 
law enforcement 


Date provided by law enforcement indicating time 
frame of production of the series 


Approximate number of images and videos in the series 


Categorization of the sexual activity depicted in the 
images and videos 


videos is restricted, for the content variables, we 
examined descriptors of series, counts of media, 
and checklists of the sexual activity depicted. 
Given the amount of missing information on 
early-identified victims, we chose to have 
separate datasets from their database. Since we 
wanted to include some of the more historical 
cases, in our first dataset, we chose to only 
include actively traded cases with an identified 
victim. In our second dataset, we chose to 


exclude cases before 2011. 
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Data Collection Method 


The team’s research coordinator began working 
onsite at NCMEC at the end of December 2014. 
After a brief orientation, the lead analysts at 
NCMEC presented Ms. Buckman with several 
spreadsheets containing the raw variables for the 
first set of data. This first dataset, the historical 
dataset, contains all actively traded cases — 
defined by NCMEC as having been reported 

on five or more times — from July 1, 2002, to 
June 30, 2014. The second dataset, the modern 
dataset, contains all cases involving identified 
child victims from July 1, 2011, to June 30, 2014. 


As discussed earlier, NCMEC receives a wide 
range of information about a given case from 
law enforcement, however, information is often 
separated into different management systems. 
For instance, one system tracks information 
related to images and videos, another tracks 
jurisdictional information and technical aspects 
of a case, and a third stores information 
concerning the series submission to NCMEC. 
Given the method by which the variables were 
queried, compiling the data into one database 


would have greatly limited the analysis. Therefore, 


the team opted for a more comprehensive 
approach and asked Ms. Buckman to synthesize 
the raw data into two different databases: cases 
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where there is only one identified victim-offender 
relationship and cases with multiple identified 
victim-offender relationships. Using this layout, 

a closer examination of the relationship between 
offender and victims is possible, while still 
answering questions surrounding case-level 
information. 


While CVIP’s services are extremely helpful to 
most law enforcement, many officers fail to 
update cases with important information or 
fully complete the law enforcement submission 
form. To compensate for the missing data, Ms. 
Buckman coded case documents for each series 
to fill in as much missing information as possible 
and to capture additional variables that NCMEC 
could not query from their data management 
systems. The co-investigators determined that 
variables needed to be at least 80% complete 

to ensure reliable statistical calculations and 
validity. At NCMEC’s suggestion, Ms. Buckman 
developed a follow up survey for law enforcement 
to collect the variables that still did not meet the 
80% threshold. 


Asummary of the variables selected, scales for 
sexual activity, and scale for offender-victim 
relationship, is provided in the Appendix. 
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Sample Selection 


It is important to note, while this dataset is 
highly unique and offers a valuable insight into a 
combination of perspectives (it combines offender, 
victim, and content data), it also has limitations. 


SAMPLE SELECTION OF LAW ENFORCEMENT 
SUBMISSIONS 


Cases received 
by NCMEC CVIP 


Cases identified 
by NCMEC CVIP 


Actively traded 
cases reported 
back to NCMEC 5 
or more times 


First, because NCMEC is entirely reliant on law 
enforcement for their information, the dataset 
excludes cases law enforcement did not pursue 
as well as information remaining unknown to 
law enforcement. 
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Furthermore, to ensure the goal of 80% 
completion per variable was achieved as well as 
enough information for each perspective to work 
with, NCMEC and the research team decided to 
focus their research efforts on cases involving at 
least one identified child. This filter was applied 
to both the historical dataset and the modern 
dataset. As such, victim information is only 
reflective of the victims identified in the case, not 
necessarily all victims present in a case. Likewise, 
information related to offenders is limited to 
those who have been reported to NCMEC by 

law enforcement. Additionally, self-produced 
cases were excluded in the analyses since their 
relationships represented a unique type of case. 


Moreover, since some cases involve multiple 
victims and some cases involve multiple 
offenders or both, the data was looked at from 
two perspectives: cases involving one victim- 
offender relationship and cases with multiple 
victim-offender relationships. These different 
perspectives allowed the use of variables that had 
been coded at either the case level or individual 
level. It is important to make the distinction as 
to what different variables say in relation to one 
another. For instance, in the historical dataset, a 
refined sample (one victim-offender relationship 
cases) was used to fully explain things such as 
sexual activity and jurisdiction, both reported 

at a case level. However, in order to maximize 
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the number of cases to work with, the multiple 
relationship data was coded (i.e., if a case had all 
girl victims the case was considered girl victim or 
if it had all infant/toddler victims it was counted 
as infant/toddler victim). For cases with mixed 
samples (e.g., victims were both boys and girls), 
a third “mixed” variable was created. This coding 
strategy was applied to victim age and gender, 
relationships of victims and offenders, and 
offenders’ gender. 


The raw NCMEC data was extremely rich with 
detail. NCMEC precisely codes the relationship 
between offenders and victims, marks checklists 
for sexual activity present, and keeps a variety 
of case information from distribution method to 
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information concerning how a case was initiated. 
To make analyses more digestible, many of the 
variables supplied to the team were grouped 

and scaled to aid in dissemination and assist in 
mapping findings onto existing literature. These 
scales and groupings are listed in the Appendix. 


The final sample criterion, only applied to the 
historical dataset, was actively traded status 

as defined by NCMEC as having been seen in 

5 or more CyberTipline reports and/or case 
submissions by law enforcement to CVIP. Due 
to changes in the law enforcement submission 
guidelines it was impossible for early, non- 
actively traded cases to match the level of detail 
of modern non-actively traded cases. 
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DATASETS 


1) HISTORICAL 


e Actively traded cases 
involving identified 
victims: July 1, 2002 
— June 30, 2014 


e 518 cases involving 
933 identified victims 


2) MODERN 


e All cases involving 
identified victims: 
July 1, 2011 — June 
30, 2014 


+ 1,965 cases: one 
offender and one victim 


e 633 cases: multiple 
offenders and/or victims 


The first dataset was a historical, cross- 
sectional slice encompassing all available actively 
traded cases involving identified victims from 
July 1, 2002, to June 30, 2014. This provided a 
look at longer-term trends over time in the nature 
of the production cases submitted to NCMEC. 

For the analyses presented in this report, we 
looked at 518 actively traded cases, which 
involved 933 victims. 


The second dataset was modern and 
encompassed all cases involving identified child 
victims from July 1, 2011, to June 30, 2014. 

The dates for this cross-sectional slice were 
chosen based on the implementation of a more 
comprehensive law enforcement submission 
form in 2011. While the historical dataset shows 
interesting trends among actively traded cases, 


some of the older cases (including their case 
documents) were missing information that is 
now included in the NCMEC database. Thus, the 
modern dataset had the benefit of being more 
complete as well as larger than the historical 
dataset. There were 1,965 cases involving one 
victim and one offender, and approximately 

7% (N=143) of those cases were actively traded. 
There were 633 cases that involved multiple 
relationships between victims and offenders, 
and approximately 12% (N=75) were actively 
traded. The larger amount of cases gave 
increased confidence in statistically significant 
differences between subgroups and comparisons, 
such as male versus female victims, male 
versus female offenders, and familial versus 
non-familial relationships. 
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Results 


Historic 
Dataset 


Results 


The NCMEC historical and modern datasets are 
unique and rich and could be used to address 

a number of different questions. In this report, 
we explore the interaction between victim 
characteristics, offender characteristics, actively 
traded status, and the content of the material, 
with the ultimate goal of developing knowledge 
to aid NCMEC and law enforcement in their work. 


An overview of the project was presented 
in August 2015 at the Dallas Crimes Against 


Children Conference (http:/www.cacconference. 


org). Preliminary results were presented at 
the annual meeting of the Association for the 
Treatment of Sexual Abusers (www.atsa.com), 
which took place in Montreal, Quebec, in 
October 2015. 
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Historic Dataset 


In this report, we have focused our analyses on 

the modern dataset since it is larger and speaks 
to current trends in child sexual abuse material, 
but have presented a few timewise trends from 

the historical dataset in the tables below. 


Table 1 shows the number of actively traded 
cases involving at least one identified victim by 
year, using the year the case was first recorded 
at NCMEC. 


Table 1 | Historic Dataset Distribution by Year 


YEAR 

2002 and 2003 
2004 and 2005 
2006 and 2007 
2008 and 2009 
2010 and 2011 
2012 and 2013 


COUNT OF CASES 
71 

75 

82 

72 

110 


108 
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Figure 1 | Year Distribution by Sexual Activity’ 
1 (Total 108) 
E 2 (Total 107) 
M 3 (Total 160) 
E 4 (Total 143) 


" (Total 518) 
41.7 
(45) 

36.4 
40 0) 
29.6 29.3 
26.8 26.8 28.0 
30 (19) 


Percentage of Distribution (%) 


tts) 16.4 16.4 
20 13 A 16. 
(18) (18) 13.9 
(15) 
10 
Q 2002-2003 2004-2005 2006-2007 2008-2009 2010-2011 2012-2013 
(Total 71) (Total 75) (Total 82) (Total 72) (Total 110) (Total 108) 


Figure 1 shows the sexual activity of each case across years. Of note, sexual activity is graded for the highest activity 


depicted in a series of images. The association is explained by a greater prevalence of images at levels 3 or 4 in 
later years. 


| Percentages don't always sum to 100% due to rounding. The sexual activities scale is shown on the following page and in the Appendix as Table 4. 


NCMEC & Thorn Research Report 


Results Historic Dataset 18 


Table 2 | 4 Point Sexual Activity Scale 


Nudity or erotic posing with no sexual activity. (Level 1 on SAP Scale) 


e Fully clothed erotica 

e Erotica present 

+ Exposed genitals or anus 

e Exposed breasts or chest 

+ Other sexual explicit content (i.e. fetishes) 
¢ Full nudity 


Non-penetrative sexual activity between children, adults and children, or masturbation. 
(Level 2+3 on SAP Scale) 


e Licking 

e Kissing 

e Manual stimulation 
e Oral copulation 


Penetrative sexual activity between adults and children. (Level 4 on SAP Scale) 


e Anal or vaginal penetration 
e Ejaculation seen 


Sadism or Bestiality (Level 5 on SAP Scale) 


e Drugged / Sleeping 
e Bestiality 

e Bondage 

e Defecation 

e Urination 
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KEY INSIGHT 


There is a 
relative shift 
for 2008-2009 
with similar 
proportions in 
other years. 
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Figure 2 | Year by Victim Age 
E Infant/Toddler (Total 87) 
E Prepubescent (Total 606) 
M Pubescent (Total 240) 


(Total 933) 
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5 0) 
® 2 9.0 
E (14) 
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(Total 117) (Total 140) (Total 170) (Total 156) (Total 183) (Total 167) 

Figure 2 shows the age category of all identified number of actively traded cases. The association 
victims across the year distribution. Of note, is explained by a shift to relatively more 
some Cases involve multiple victims, hence pubescent victims in 2008 - 2009, with more 
why the number of victims is larger than the similar proportions in other years. 
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KEY 


M Female (Total 574) 
M Male (Total 359) 
(Total 933) 
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Figure 3 | Year by Victim Gender 


100 
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G 71.8 
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2002-2003 2004-2005 2006-2007 2008-2009 2010-2011 2012-2013 
(Total 117) (Total 140) (Total 170) (Total 156) (Total 183) (Total 167) 


Figure 3 shows the gender of all identified victims There was significant variation in the proportion 
across the year distribution. Of note, some cases of male victims over time, but there was no 


involve multiple victims, hence why the number obvious trend because the percentage increased 
of victims is larger than the number of actively from the first period and then substantially 
traded cases. decreased in the last period. 
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Results 


Modern 
Dataset 


Modern Dataset 


In the modern dataset, we subdivided the data 
into cases that involved only one relationship (one 
victim and one offender) and cases that involved 
multiple relationships (either multiple victims or 
offenders or both). 


In the one relationship subgroup, victims were 
predominantly white (85%), pubescent (61%) 
females (76%) with non-familial relationships 
(74%) to white (86%) male (98%) offenders. In 

our second perspective, which looked at cases 
with multiple victim-offender relationships, 
victims were also predominantly pubescent (42%) 
female (62%) with non-familial relationships 
(59%) to male (82%) offenders. Most content in 
the one-to-one series involved level 1 sexual 
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activity (40%), whereas those series with multiple 
relationships involved more level 3 content (30%). 
See Table 3 on the following pages. 


We have not included offender ethnicity in our 
general descriptive table or our analysis because 
of the extent of the missing data; this variable 
did not meet our 80% threshold. This is most 
likely due to the fact that it is hard to judge the 
ethnicity of depicted persons as a result of poor 
photo quality or when only partial figures (i.e., 
arms, legs) were visible. NCMEC coding was 
conservative and so entries were only made if 
analysts were confident. The law enforcement 
survey also had a low yield for this variable 

as well. 
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Table 3 | Modern Dataset Characteristics 


ONE ON ONE (N=1,965) 
RELATIONSHIP BREAKDOWN 
Not Family (Closer in Proximity) 37% (728) 
Not Family (Unknown To Child)? 37% (723) 


Family (Extended Family) 16% (305) 
Family (Nuclear Family) 11% (209) 
Mixed -- (--) 
SEXUAL ACTIVITY 

1 40% (764) 
2 20% (376) 
5 26% (490) 
4 14% (271) 


64 cases were coded as unclear 


VICTIM AGE 

Infant/Toddler 6% (112) 
Prepubescent 33% (644) 
Pubescent 61% (1,209) 
Mixed -- 


2 Unknown to child includes those some refer to as “strangers,” sex traffickers, and missing data (see Appendix - Table 5). 
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MULTIPLE RELATIONSHIPS (N=633) 


59% (374) 
-- (--) 
21% (134) 
-- (--) 
20% (125) 


28% (173) 
21% (129) 
30% (183) 
20% (125) 


23 cases were coded as unclear 


3% (22) 
31% (196) 
42% (264) 
24% (151) 
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Table 3 | Modern Dataset Characteristics (continued) 


ONE ON ONE (N=1,965) 


MULTIPLE RELATIONSHIPS (N=633) 


VICTIM GENDER 
Female 

Male 

Mixed 


76% (1,486) 
24% (479) 
-- (--) 


62% (393) 
22% (141) 
16% (99) 


OFFENDER GENDER 


Female 
Male 


Mixed 


ACTIVELY TRADED STATUS 


Not Traded 
Traded 


2% (41) 
98% (1,726) 
-- (--) 


198 observations missing 


93% (1,822) 
7% (143) 


3% (17) 
82% (494) 
15% (87) 


35 observations missing 


88% (558) 
12% (75) 
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KEY 


M Actively traded 
(Total 143) 


Not actively traded 
(Total 1,822) 


(Total 1,965) 


Modern Dataset: One Relationship 


As noted in the sample selection section, 
NCMEC records information at both the case and 
individual level. Since key variables are coded at 
the case level, such as sexual activity, we chose 
to analyze the subset of cases with only one 
victim-offender relationship separately. These 
cases allow us to speak directly to the variables 
involved rather than providing grouped values or 
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generalizations about the case. The tables below 
show the distribution of the data (N=1,965). If any 
data is missing from the comparison, it is also 
noted in the table. Statistically significant odds 
ratios are reported beneath the tables. If the odds 
ratio is not presented, it can be assumed the 
difference was not statistically significant. 


Figure 4 | One Relationship - Victim Gender by Actively Traded Status 


Female 
(Total 1,486) Male (Total 479) 
7.2% (107) 7.5% (36) 


92.8% (1,379) 92.5% (443) 


There was no significant difference in actively 
traded status based on victim gender. 


NCMEC & Thorn Research Report 


Results Modern Dataset 26 


Figure 5 | One Relationship - Victim Age by Actively Traded Status 


KEY ea a 
M Actively traded 


(Total 143) Infant / Toddler Prepubescent Pubescent 

Not actively traded (Total 112) (Total 644) (Total 1,209) 

(Total 1,822) 8.9% (10) 15.8% (102) 2.6% (31) 
911% (102) 84.2% (542) 97.4% (1,178) 


(Total 1,965) 


Cases with a prepubescent victim were much more likely to be traded than either 
infant/toddler or pubescent victims, suggesting this was the preferred age category. 


Figure 6 | One Relationship - Offender Gender by Actively Traded Status 


KEY a 2 


E Actively traded 


(Total 139) 
Not actively traded Female (Total 41) Male (Total 1,726) 
(Total 1,628) 4.9% (2) 7.9% (137) 


951% (39) 92.1% (1,589) 
(Total 1,767) 
(Missing 198) 


There was no statistically significant difference 
between male and female offenders. 
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Figure 7 | One Relationship - Sexual Activity Scale by Actively Traded Status 


= 95.6 94.4 
: 100, (730) ZEE 
® Actively traded L (355) 91.0 
(Total 143) (446) a 
Not actively traded (227) 
(Total 1,758) 
80 
(Total 1,901) = 
(Missing 64) 5 
= 
© 
5 
a 60 
£ 
A 
A 
4 
O 
Lo] 
8 40 
[= 
® 
oO 
= 
[0] 
à 
20 
4.4 5.6 
(34) (21) 
o m D 
1 2 3 4 


(Total 764) (Total 376) (Total 490) (Total 271) 


Each one point increase in the sexual activity scale 
was associated with a greater likelihood of being 
actively traded. 
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KEY (NON-FAMILIAL) 


E Actively Traded 
Not Actively Traded 


KEY (FAMILIAL) 


E Actively Traded 
Not Actively Traded 


3 
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Figure 8 | One Relationship - Relationship by Actively Traded Status 


O 20 
: = 6.1 
Non-Familial (Total 1,451) (88) 
TN TOR 8.7 
Total 728) 
Close Proximity ( al /28) mn (63) 
Unknown to the Child? (Total 723) 3.5 
(25) 
ies 10.7 
Familial (Total 514) (55) 
E ee 8.2 
Total 305) 
Extended Family (1 | 505) (25) 
tv (Total 2001 14.4 
Nuclear Family (Total 209) (30) 


Cases with a familial relationship were more 
likely to be actively traded than cases with a 
non-familial relationship. Additional analysis 
revealed the difference was explained by cases 
involving nuclear family members being the 


Percentage of Distribution (%) 
40 60 80 100 


most likely to be actively traded, and cases 
involving a person who is unknown to the victim 
or with whom the victim is unacquainted to be 
the least likely. Relationship coding is listed in 
Table 5 (Appendix). 


Unknown to child includes those some refer to as “strangers,” sex traffickers, and missing data (see Appendix - Table 5). NCMEC & Thorn Research Report 
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Figure 9 | One Relationship - Offender Gender by Relationship 


KEY 


M Familial (Total 512) 


Though male offenders far outnumbered 
E Non-Familial (Total 1,255) 


Female (Total 41) Male (Total 1,726) female offenders, cases involving female 


(Total 1167) 61.0% (25) 28.2% (487) offenders were much more likely to 
(Missing 198) 39.0% (16) 71.8% (1,239) . a . . 
involve a familial relationship. 


Figure 10 | One Relationship - Victim Gender by Relationship 


KEY 
E Familial (Total 514) | | 
M Non-Familial (Total 1,451) Female Cases involving female children 
(Total 1.965) (Total 1,486) Male to) were more likely to involve a familial 
27.9% (415) 20.7% (99) 


79.3% (380) relationship with the offender. 


721% (1,071) 
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Figure 11 | One Relationship - Victim Age by Relationship 


KEY 


E Familial (Total 514) 
E Non-Familial (Total 1,451) 
(Total 1,965) 


Infant / Toddler 
(Total 112) 


Prepubescent 
(Total 644) 


Pubescent 


(Total 1,209) 
58.9% (66) 


41.1% (46) 


42.6% (274) 
57.4% (370) 


14.4% (174) 
85.6% (1,035) 


Cases involving pubescent victims were much 
less likely to involve a familial relationship 
(14% compared to 59% for infants/toddlers and 
43% for prepubescent victims). 


NCMEC & Thorn Research Report 


Results Modern Dataset 31 


Figure 12 | One Relationship - Sexual Activity Scale by Relationship 


KEY 


M Familial (Total 502) 


E Non-Familial 
(Total 1,399) 1 (Total 764) 2 (Total 376) 
24.5% (187) 23.7% (89) 


(Total 1,901) 75.5% (577) 76.3% (287) 


(Missing 64) 


4 (Total 271) 


40.6% (110) 
59.4% (161) 


3 (Total 490) 
23.7% (116) 
76.3% (374) 


Cases involving the most egregious content 
(level 4) were much more likely to involve a 
familial relationship between offender 

and victim. 


NCMEC & Thorn Research Report 


KEY 


MB Actively traded 
(Total 75) 
Not actively traded 
(Total 558) 


(Total 633) 
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Cases Involving Multiple Offender-Victim Relationships 


The findings presented below included cases “male only,” and if the case included both male 
involving multiple offenders and/or multiple and female victims it would be marked “mixed.” 
victims, unlike the one-to-one cases just This has also been applied to victim age, offender 
described. To capture this, we added a “mixed” gender, and relationships. The figures below show 
category: For example, if a case involved only the distribution of the data (N=633). If any data 
female victims it would be marked “female only,” are missing from the comparison, it is also noted 


if it involved only male victims it would be marked in the figure. 


Figure 13 | Multiple Relationships - Victim Gender by Actively Traded Status 


) = y 


Female Only Male Only Mixed 
(Total 393) (Total 141) (Total 99) 
10.2% (40) 12.1% (17) 18.2% (18) 

89.8% (353) 87.9% (124) 81.8% (81) 


Cases with both male and female victims 
(“mixed”) were more likely to be actively traded. 
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KEY INSIGHT 


Infant/toddler 
only content was 
the most likely 
to be actively 
traded. 
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Figure 14 | Multiple Relationships — Victim Age by Actively Traded Status 


Infant / Toddler Only (Total 22) 
22.7% (5) 
77.3% (17) 


Unlike the one-to-one analysis, where cases 
involving prepubescent victims were the most 
likely to be actively traded, infant/toddler 
content was the most likely to be actively 
traded in cases involving multiple offenders 
and/or victims. 


Prepubescent Pubescent 
Only (Total 196) Only (Total 264) 
19.9% (39) 2.6% (7) 
80.1% (157) 97.4% (257) 
| è ® Actively traded 
Mixed Ages (Total 75) 
ss oa Not actively traded 
84.1% (127) (Total 558) 
(Total 633) 


One possible explanation is that multiple 
relationship cases in which images were actively 
traded were more likely to involve a family 
member (see figure 17) than one-to-one cases 
and family members have more access to 
infants or toddlers. 
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Figure 15 | Multiple Relationships - Sexual Activity Scale by Actively 


Traded Status 
KEY 
M Actively Traded 
(Total 75) 
H Not Actively Traded 1 (Total 173) 2 (Total 129) 3 (Total 183) 4 (Total 125) 
(Total 535) 5.2% (9) 10.1% (13) 15.8% (29) 19.2% (24) 
94.8% (164) 89.9% (116) 84.2% (154) 80.8% (101) 
(Total 610) 
(Missing 23) 


Again, the likelihood of being actively traded increased with sexual activity level. 
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KEY INSIGHT 


Cases more 
likely to be 


actively traded: 


¢ male and 
female 
offenders 


- familial only 
relationships 
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Figure 16 | Multiple Relationships - Offender Gender by Actively 


ER 


Traded Status 


zy, 


M Actively traded 


P (Total 72) 
Female Only Re Mixed (Total 87) Not actively traded 
(Total 17) aaraa) 14.9% (13) (Total 526) 
0% (0) 11.9% (59) legis (74) Sia 
100% (17) 88.1% (435) di (Total 598) 
(Missing 35) 


Cases involving both male and female offenders were more likely to involve actively traded content. 


Figure 17 | Multiple Relationships - Relationships by Actively Traded Status 


- = 


M Actively traded 


Familial Only Non-Familial | 
(Total 134) Only (Total 374) Mixed (Total 125) (Total 75) 
18.7% (25) 9.1% (34) 12.8% (16) Not actively traded 
81.3% (109) 90.9% (340) 87.2% (109) (Total 558) 
(Total 633) 


Again, cases involving family offenders were more likely to be actively traded. 
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KEY 


M Familial (Total 132) 


Hi Non-Familial 
(Total 341) 


Mixed (Total 125) 


(Total 598) 
(Missing 35) 


KEY 


M Familial (Total 134) 


Hi Non-Familial 
(Total 374) 


Mixed (Total 125) 
(Total 633) 
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Figure 18 | Multiple Relationships - Offender Gender by Relationship 


41.2% (7) 
29.4% (5) 
29.4% (5) 


19.8% (98) 


65.2% (322) 
15.0% (74) 


Female Only Male Only 
(Total 17) (Total 494) 


31.0% (27) 
16.1% (14) 
52.9% (46) 


Mixed 
(Total 87) 


Figure 19 | Multiple Relationships - Victim Gender by Relationship 


21.4% (84) 
58.3% (229) 
20.4% (80) 


12.1% (17) 


71.6% (101) 
16.3% (23) 


Female Only Male Only 
(Total 393) (Total 141) 


33.3% (33) 
44.4% (44) 
22.2% (22) 


Mixed 
(Total 99) 
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KEY INSIGHT 


Data shows 
there is a relative 
association 
between 
pubescent 
victims and 
non-familial 
offenders. 
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Figure 20 | Multiple Relationships - Victim Age by Relationship 


7.2% (19) 


81.8% (216) 
11.0% (29) 


Pubescent Only 
(Total 264) 


The most notable result here is the relative 
association between pubescent victims and 
non-familial offenders, paralleling the finding 
reported in Figure 11 (one relationship). 


Infant/Toddler Only Prepubescent Only 
(Total 22) (Total 196) 


31.8% (7) 
31.8% (7) 
36.4% (8) 


33.7% (66) 
38.8% (76) 
27.5% (54) 


E Familial (Total 134) 


Hi Non-Familial 
(Total 374) 


Mixed (Total 125) 


27.8% (42) 
49.7% (75) 
22.5% (34) 


(Total 633) 


Mixed 
(Total 151) 
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Figure 21 | Multiple Relationships - Sexual Activity by Relationship 


KEY 


M Familial (Total 129) 
HM Non-Familial (Total 358) 
Mixed (Total 123) 


20.8% (36) 
55.5% (96) 
23.7% (41) 


15.5% (20) 20.2% (37) 28.8% (36) 
48.0% (60) 


23.2% (29) 


67.4% (87) 62.9% (115) 
17.7% (22) 16.9% (31) 


(Total 610) 
(Missing 23) 


1 (Total 173) 2 (Total 129) 3 (Total 183) 4 (Total 125) 


There was no significant difference in each one point increase in the sexual activity scale when 
comparing familial only to non-familial only, familial only to mixed, or non-familial only to mixed. 
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Figure 22 | Multiple Relationships - Victim Age by Offender Gender 


KEY 


E Female Only (Total 17) 
M Male Only (Total 494) 


91% (2) 3.3% (6) 1.2% (3) 4.0% (6) 
Mixed (Total 87) 50.0% (11) 73.5% (136) 89.7% (218) 87.2% (129) 
(Total 598) 40.9% (9) 23.2% (43) 91% (22) 8.8% (13) 
(Missing 35) 


Infant/Toddler Only Prepubescent Only Pubescent Only Mixed 
(Total 22) (Total 185) (Total 243) (Total 148) 


Most victims in all age groups were victimized by male offenders. 
However, cases involving infant/toddler or prepubescent victims 
differed from other age groups by being more likely to involve 
both male and female offenders. 
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KEY 
B Female Offender Only 
(Total 17) 


Hi Male Offender Only 
(Total 494) 


Mixed Gender Offender 
(Total 87) 


(Total 598) 
(Missing 35) 
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Figure 23 | Multiple Relationships - Victim Gender by Offender Gender 


1.6% (6) 1.5% (2) 9.6% (9) 


80.1% (298) 91.7% (121) 79.8% (75) 
18.3% (68) 6.8% (9) 10.6% (10) 


Female Victim Only Male Victim Only Mixed Gender Victims 
(Total 372) (Total 132) (Total 94) 


There was no obvious trend in the relationship between offender and victim 
gender. It was still the case that most offenders in these cases were male 
(including mixed) and the majority of victims were female. 
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KEY 


M Female Only (Total 17) 
Hi Male Only (Total 479) 
Mixed (Total 85) 


(Total 581) 
(Missing 52) 
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Figure 24 | Multiple Relationships - Sexual Activity by Offender Gender 


1.8% (3) 2.5% (3) 4% (7) 3.2% (4) 


78.3% (137) 87.8% (108) 


82.8% (135) 82.5% (99) S Ke 
17.7% (31 8.9% (11 


15.4% (25) 15.0% (18) 


1 (Total 163) 2 (Total 120) 3 (Total 175) 4 (Total 123) 


There was no obvious trend in terms of sexual activity level relative to offender gender. 
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Most notable 


historical finding: 


trend toward 
more egregious 
sexual content 
over time. 


In the following, we first discuss the results from the historical dataset 
and then from the modern dataset, because the data were organized 
and examined differently. We then conclude with implications for policy 
and practice regarding law enforcement. 


Historical Dataset 


The historical dataset suggests there has 
indeed been a shift toward more egregious 
content over time, with more content rated 

at levels 3 or 4 on the sexual activity scale in 
later years. This is different from other analyses 
of child images, such as those reported by Wolak 
et al. (2011, 2012), but results are not directly 
comparable because we focused our analysis 

on cases involving adult producers and actively 
traded content. 


The NCMEC data indicated variation but no 
obvious trend in the proportion of boy victims 
over time. Wolak, Finkelhor, and Mitchell (2011) 
reported a small decrease in boy victims between 
2000 to 2006 (20% to 13%). With the INTERPOL 
database analysis, gender of the children varied 


over the years, with two-thirds (63%) involving 
girls. The only exception was in 2013, when boys 
were in the majority (Quayle, E., Jonsson, L., 
Cooper, K., Trayner, J. and Svedin, C-G., 2018). 
The Internet Watch Foundation (2013) data 
indicated 26% of identified images were boys 

in 2011, going down to 11% over the following 
two years. 


Modern Dataset 


Actively traded cases were associated with 
having prepubescent victims. Actively traded 
cases were also associated with more 
egregious content in terms of sexual activity, 
and more likely to involve familial offenders, 
particularly nuclear family members. A familial 
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KEY INSIGHT 


Cases involving 
female offenders 
were more likely 
to also involve: 


e male offenders, 
- related victims, 
e younger victims, 


e and to be actively 
traded 


offender-victim relationship was relevant in a 
number of other ways besides being more likely 
to be actively traded. Cases involving familial 
relationships were more likely to involve female 
offenders, female victims, more egregious 
content, and younger victims. 


Male offenders were much more common than 
female offenders in this dataset, similar to 
previous research on online offending samples 
(see Babchishin, Hanson, & VanZuylen, 2015). 
Nonetheless, the involvement of female 
offenders was important when examining 
cases involving multiple offender-victim 
relationships. Cases involving female offenders 
were more likely to also involve male offenders, 
related victims, younger victims, and to be 
actively traded. 


Integrating these different findings, the 

pattern of associations we observed indicates 
male offenders are the most common, as 
demonstrated in multiple prior studies. These 
male offenders are more likely to target girls who 
are unrelated to them, especially pubescent girls. 
However, there were also cases involving both 
male and female offenders. Different associations 
suggest these cases involve mostly unrelated 
male offenders co-offending with female 
offenders who were more likely to be related 

to victims, especially younger victims. These 
co-offending cases, denoted by mixed gender 
offenders, are more likely to have both boy 
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and girl victims. 


Though we are aware of cases where unrelated 
male offenders contact women with custody of 
children in order to produce child pornography 
content that may then be distributed to others, 
this is largely an unexplored phenomenon in the 
scientific literature. These cases suggest female 
offenders are not explained by current models 

of online offending developed using research 
with male offenders. Case studies of female 
producers of child pornography suggest their 
criminal conduct is not related to pedophilia (Prat, 
Bertsch, Chudzik & Réveillére, 2014). Prat et al. 
hypothesized that producing images allowed 
women perpetrators to meet the desires or needs 
of their romantic partners, which was important 
enough to the women to overcome any inhibitions 
against exploiting children in their care. 


This pattern of results can be interpreted in light 
of how we understand access and opportunity 
play a role in child sexual exploitation and abuse. 
Through social media and other online channels, 
men can have contact with pubescent children, 
particularly girls (Whittle, Hamilton-Giachritsis, 
Beech & Collings, 2013; Quayle, Allegro, Hutton, 
Sheath & Lööf, 2014; Winters, Kaylor & Jeglic, 
2017). Some men who are interested in younger 
children, however, may contact and eventually 
conspire with women who have contact with 
younger children. 


KEY INSIGHT 


Images depicting 
younger children 
and/or more 
egregious 
content are 
more likely to 
involve familial 
offenders and 
were more 

likely to be 
actively traded. 


Implications for Law Enforcement 


Given limited law enforcement resources relative 
to the number of tips, reported contacts, and 
responses to personas, decisions have to be 
made about how to allocate time and effort. 
Decision-making algorithms would be helpful 

in this regard, and was the rationale for the 
development of the Child Pornography Offender 
Risk Tool (CPORT: Seto & Eke, 2015). However, 
producers of child exploitation content were a 
minority of the sample in the development of the 
CPORT, and there may be important differences 
between producers and possessors of this content. 


Knowing more about those engaging in 
production of child exploitation images can serve 
to improve the efficiency of law enforcement 
operations. Knowing what type of images are most 
likely to be produced can help law enforcement 
plan their investigations accordingly. Using a 
large dataset, this study has replicated and 
extended previous research. 
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A significant finding is that prepubescent children 
are sought more than other age groups from 

this study's sample, and the finding that victim 
cases involving young children are more likely 

to involve at least one perpetrator related to the 
child and both male and female perpetrators. 

Our findings also suggest images depicting 
younger children and/or more egregious 
content are more likely to involve familial 
offenders. This information could be useful to law 
enforcement during victim identification efforts 
and investigations, perhaps keeping in mind that 
while looking for very young victims, the offender 
is relatively likely a family member. 


Another finding relevant for law enforcement is 
not all images are traded with equal frequency. 
Those with the most egregious content and 
those with a familial relationship between 
victim and perpetrator were more likely to 

be actively traded. 
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Appendix 


Table 4 | 4 Point Sexual Activity Scale 


Nudity or erotic posing with no sexual activity. (Level 1 on SAP Scale) 


e Fully clothed erotica 

e Erotica present 

e Exposed genitals or anus 

e Exposed breasts or chest 

+ Other sexual explicit content (i.e. fetishes) 
e Full nudity 


Non-penetrative sexual activity between children, adults and children, or masturbation. 
(Level 2+3 on SAP Scale) 


e Licking 

e Kissing 

e Manual stimulation 
e Oral copulation 


Penetrative sexual activity between adults and children. (Level 4 on SAP Scale) 


e Anal or vaginal penetration 
e Ejaculation seen 


Sadism or Bestiality (Level 5 on SAP Scale) 


+ Drugged / Sleeping 
e Bestiality 

e Bondage 

e Defecation 

e Urination 
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Table 5 | Relationship Scale 


FAMILIAL Nuclear Family + Mother 

e Father 
Brother 
Sister 

e Half Sibling 


Step-Father 

e Step-Mother 

e Aunt 

Uncle 
Grandfather 

e Step-Grandparent 


Brother-in-Law 


Cousin 
e Legal Guardian 
e Other Relative 


Babysitter/mentor/coach/teacher 


NON-FAMILIAL | Close Proximity 


+ Boyfriend 
¢ Guardian's Partner 


Neighbor/Family Friend 


Unknown to Victim + No Relationship 
Online Enticement/Self & Perp Produced 


Photographer 
+ Sex Trafficker 
Stranger 


Unknown 
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